July 21, 2004
Uh, Professor Kerr, Sir...
Volokh Conspirator Orin Kerr likes a new Flash, but he seems to have missed its point:
[T]here is something a bit fishy about the movie in the context of the ACLU's campaign: it seems that everything in the movie involves private-sector information gathering, and yet the "action" that the ACLU prompts you to take appears to be focused primarily on government datamining. Based on the ACLU website, it seems that the primary goal of the ACLU's campaign is to defund the MATRIX law enforcement database. Maybe I'm missing something, but it's not obvious to me what the connection is between MATRIX and what the pizza guy knows about you. Private-sector information gathering is quite different from government datamining: the former concerns restrictions on private parties obtaining information, and the latter concerns government agencies sharing and looking through the information that they have already obtained. I guess MATRIX didn't lend itself to a funny movie.
According to the ACLU page linked,
Matrix (which stands for "Multistate Anti-Terrorism Information Exchange") is an effort to combine state government records, such as driver’s license information, with commercially available data to create a vast database capable of compiling and analyzing a profile of every American [... G]iven the amount of information that is available in today's commercial databases, even more details of your private life might be captured and catalogued. Indeed, the Matrix materials boast of having access to 20 billion records.
The ACLU appears to fear that the government and the GAP will share information, a la Minority Report
, in a future where such cooperation is supposed to help the citizen-consumer but actually aids the authorities in tracking down Tom Cruise's eyeballs.
July 21, 2004 06:09 PM
Interesting post, but I'm not sure I missed the point. The ACLU may see private-sector information gathering as connected to government datamining; they may fear that MATRIX is just a slippery slope away from Minority Report. But the point of my post was to note that the connection is a bit tenuous.
Along those lines, it may be worth noting that the ACLU's description of MATRIX is a bit different from the description on the MATRIX website. According to http://www.matrix-at.org/data_sources.htm, MATRIX's databases do not contain the following:
"Telemarketing calling lists
Direct mail mailing lists
Airline reservations or travel records
Frequent flyer/hotel stay program membership or activity
Magazine subscriptions lists or reading lists
Telephone calling logs or records
Credit card or debit numbers
Purchases (e.g., retail store, Internet, or even gas stations)
Mortgage or car payments
Bank account numbers or account balances
The costs of a home addition
Utility bill payments (i.e., gas, electric, phone, heating oil, cable or satellite TV)
Therefore, such data is not provided to law enforcement. Under federal law, when such data is required to further a law enforcement investigation, law enforcement must obtain a judicial order (i.e., subpoena) and serve it directly on the organization having or owning such data."
As it stands now, Prof. Kerr's point is well-taken. I think it is clear, as noted elsewhere, that the ACLU is propogandizing, which is perfectly acceptable and perhaps needed on this important issue.
Now, I don't know much about the apparently statutory law that the MATRIX site refers to as quoted above: "Under federal law, when such data is required to further a law enforcement investigation, law enforcement must obtain a judicial order (i.e., subpoena) and serve it directly on the organization having or owning such data." I have reason to doubt that. Suppose that when private, commercial organizations, like the Pizza Hut, collect personal information they do so with a waiver. Some already direct waivers at information-sharing among other private groups, especially to overcome state and federal privacy statutes. Now, what if they did this with regard to sharing with the government? If I waived my rights in transaction with the commercial organization, the waiver permits MATRIX to collect the information and share it with the government. Something tells me this would overcome any statutory problems as it stands today.
Of course, the fact that this waiver system is not in existence reveals moreover that Prof. Kerr's note on the lack of a solid connection is correct.
Correction: It should read above that I have NO REASON to doubt that federal law requires as much as the MATRIX site purports.
In Prof. Kerr's defense, I'd like to add that MATRIX was designed primarily as a means for state/local law enforcement agencies to share their law enforcement information, i.e. past offenses, arrests, outstanding warrants, etc. It's less of a data-mining system than a large, relational database with rapid query capability.
TIA, on the other hand, *did* envision the gathering and analysis of commercial credit databases and commercial transaction information. The TIA concept included this because terrorist/enemy activity could leave a trace in these commercial databases, and TIA's designers were building a system that could look for non-obvious relationships wherever they might be. Thus, TIA would have included the government sources of data like law enforcement records, as well as the commercial sources like your credit report and bank records.
So, in theory, if you wrote a check or used a credit card to pay for your pizza, or ate so much that you entered into a payment agremeent for it, or left some other discernible digital trail of pizza-eating, THEN you would have your pizza-eating habits picked up by the TIA system. (Not by MATRIX though) It's easy to laugh and scoff at why you'd want to monitor something like this. But operationally speaking, the monitoring of commercial transactions serves some purpose. Remember that Tim McVeigh built his bomb out of entirely commercially available products -- fertilizer, a Ryder truck, etc. Surveillance over some critical things (though probably not pizza) may be relevant to counter-terror work.